MULTISTATE SUPPLEMENT TO SWORDFISH PRIVACY POLICY

Last Updated: March 18, 2025

THIS SUPPLEMENT IS INTENDED FOR RESIDENTS OF COLORADO, CONNECTICUT, DELAWARE, IOWA, MONTANA, NEBRASKA, NEW HAMPSHIRE, NEW JERSEY, OREGON, TEXAS, UTAH, AND VIRGINIA. WE REFER TO THESE STATES IN THIS SUPPLEMENT AS “THE COVERED STATES.”

IF YOU ARE A RESIDENT OF ONE OF THESE COVERED STATES, WE ENCOURAGE YOU TO READ THIS SUPPLEMENT CAREFULLY AND USE IT TO MAKE INFORMED DECISIONS. BY USING OUR SERVICES, YOU AGREE TO THE TERMS OF THE PRIVACY POLICY AND THIS SUPPLEMENT, AND YOUR CONTINUED USE OF THE SERVICES CONSTITUTES YOUR ONGOING AGREEMENT TO THE PRIVACY POLICY AND THIS SUPPLEMENT.

GENERAL

This Multistate Supplement to Swordfish Privacy Policy assists in our privacy compliance program in the United States and specifically in the Covered States. The Covered States’ laws covered by this Supplement are:

• The Colorado Privacy Act

• The Connecticut Data Privacy Act

• The Delaware Personal Data Privacy Act

• The Iowa Consumer Data Protection Act

• The Montana Consumer Data Privacy Act

• The Nebraska Data Privacy Act

• The New Hampshire Privacy Act

• The New Jersey Data Protection Act

• The Oregon Consumer Privacy Act

• The Texas Data Privacy and Security Act

• The Utah Consumer Privacy Act

• The Virginia Consumer Data Protection Act

These laws afford certain individual rights to residents of these states.

This Supplement outlines the individual rights Swordfish AI Inc. (the “Swordfish”, “we,” “us,” or “our”) provides to the residents of the Covered States with respect to collecting, using and disclosing personal data when providing our online services (collectively, the “Services”) and constitutes an integral part of Swordfish’s Terms of Service (“Terms”, and collectively, the “Agreement”).

This Supplement is an integral part of the Swordfish Privacy Policy linked here. It is not a standalone privacy policy. Rather, this Supplement provides privacy disclosures to residents of the Covered States as required by these states’ laws to supplement the Privacy Policy.

As stated in the Privacy Policy, we collect personal data from “Users,” who are Swordfish individual customers or business customer representatives who download, install, or use the Swordfish browser extension. We also collect personal data from “Contacts,” who are people whose identities are being confirmed, who are the subject of an investigation, or who are being contacted by Users, for example for recruitment or sales purposes. Using the Swordfish Services (e.g., plugin or website interface), Users can lookup “Business Profiles” of Contacts by social media URL, name, phone number, email address, or postal address. The Services return the available contact information (name, phone number, email address, location (city and country), company name, and job title) and social media account URLs.

Note: Covered States’ laws may use the term “personal data” to refer to an individual’s private information. The term “personal data” in this Supplement is intended to mean the same as the term “personal information” used in the Swordfish Privacy Policy.

Covered States’ laws afford certain individual rights to residents of these states. We describe these rights in this section. Our obligation to afford you these rights or provide notifications to you, however, are subject to any contrary laws, rules, or law enforcement demands.

DISCLOSURES UNDER VIRGINIA, CONNECTICUT, AND COLORADO LAW

• Categories of Personal Data Processed
  The categories of personal data processed by Swordfish are described in Section 3 of the Swordfish Privacy Policy.

• Purposes for Processing Personal Data
  The purposes for Swordfish processing personal data are described in Section 6 of the Swordfish Privacy Policy.

• Exercising Individual Rights
  If you wish to contact us about any of your rights as set out in this Supplement, please contact us by one of the methods listed below in the Contact Us section. Please contact us using one of these methods if you wish to have an authorized agent, parent, or guardian make a request for individual rights on your behalf.

• Categories of Personal Data Shared with Third Parties
  Swordfish shares Business Profiles (discussed above) with third parties: available contact information (name, phone number, email address, location (city and country), company name, and job title) and social media account URLs.

• Categories of Third Parties to Whom Swordfish Discloses Personal Data
  Swordfish allows its Users to search for and access Business Profiles of individuals. Other categories of third parties to whom Swordfish discloses personal data are described in Section 7 of the Swordfish Privacy Policy.

• Sale of Personal Data
  Swordfish’s Services involving selling access to personal data of Contacts. Accordingly, if we have personal data about you, it may be “sold” to our customers. To opt out of sales of your personal data, please follow the instructions in the Right to Opt Out of Sale section below.

INDIVIDUAL RIGHTS

Covered States’ residents have privacy rights described in this Section. Details may vary from state to state, but Swordfish is committed to affording Covered States’ residents the rights described in this Section. Even where a Covered State does not afford its residents one or more of the following rights, Swordfish will, by its policies, afford the same rights required by other Covered States.

By Swordfish policy, the identity of any person requesting to exercise these rights must be verified as a condition of providing the requested information. If you are an authorized agent, parent, or guardian of an individual wishing to exercise these individual rights, we will also need to verify your authority to act on behalf on that individual. If we are unable to verify your identity or authority or we believe that the request is fraudulent, we may ask for additional verifying information. If such information is insufficient to verify your identity or authority, we may decline to allow an exercise of individual rights.

• Right of Access
  Upon request, we will confirm if we are processing personal data of a resident of a Covered State.

• Right of Correction
  Upon request, we will correct inaccuracies in an individual Covered State resident’s personal data in light of the nature of the personal data and the purposes of processing it. This right is subject to Swordfish’s obligation or entitlement under applicable law to preserve personal data as it currently is recorded in Swordfish’s records.

• Right of Deletion
  Upon request, we will delete personal data about a resident of a Covered State. However, we may retain sufficient personal data for the limited purpose of ensuring that any deleted personal data remains deleted from Swordfish’s records.

• Right of Data Portability
  Covered State residents have the right, upon request to Swordfish, to obtain a copy of any personal data that they previously provided to Swordfish in a portable and, to the extent technically feasible, readily usable format that allows the resident to transmit the data to another service provider.

• Right to Opt Out of Sale
  Covered State residents have the right to opt out of the sale of personal data. If you prefer that we not sell your personal data (by disclosing your Business Profile to our Users, vendors or business partners), you may opt-out by filling in your relevant details at https://swordfish.ai/Optout.

POLICY AGAINST DISCRIMINATION

Covered State residents have a right not to receive discriminatory treatment by any business covered by the privacy laws of the Covered States for the exercise of the privacy rights conferred by one of these laws. Accordingly, Swordfish will not discriminate against individual Covered State residents for exercising any of their rights under the privacy laws of a Covered State, including by:

• Denying goods or services to the Covered State resident

• Charging different prices or rates for goods or services

• Providing a different level or quality of goods or services

CONTACT US

If you have any questions, comments or concerns about this Supplement or about our privacy practices, seek to exercise any of your privacy rights under applicable law, or wish to access, change, or update personal data we have about you, you should first contact us by email at contact@swordfish.ai. You may also contact us at this email address if you are aware of abuse or misuse of our Services. If you are a Contact, you may also opt out of the sale of your personal data as stated in the next section.

If you wish to reach us by phone to exercise any of your privacy rights, you may call us toll free at (855) 512-9715.

COMPLAINTS AND APPEALS

If you have a complaint about our privacy practices regarding Covered State residents, please follow the procedures in our Privacy Policy in the section titled Contact Us; Exercising Individual Rights; Complaints (Section 16). Please follow these procedures if you wish to appeal Swordfish’s decision not to afford you or your representative your individual rights under the laws of a Covered State. Any such appeal must include the facts and circumstances supporting your or your representation’s belief that the denial was incorrect.

If Swordfish denies your appeal of a decision not to afford you with individual rights, you may contact your state Attorney General to submit a complaint. Please refer to the contact information of your state’s Attorney General on its website to find the appropriate page to submit a complaint.